What is the CVSS score of CVE-2026-70794?

CVE-2026-70794 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Hyperion Financial Reporting CVE-2026-70794

EUVD-2026-61745 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-jmxr-x4g6-2cjx

Authentication Bypass Oracle Hyperion Financial Reporting

4.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.7 MEDIUM

Local infrastructure logon mandatory and Oracle's 'difficult to exploit' characterization confirm AV:L and AC:H; low-privileged account required warrants PR:L; description confirms integrity-only impact with no confidentiality or availability effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 05:18 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Reporting executes to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to possess an active low-privileged logon (operating system or equivalent infrastructure account) on the physical or virtual host where Oracle Hyperion Financial Reporting 11.2.25.0.000 executes - remote network-based exploitation is not possible given the local attack vector (AV:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.7 (Medium) accurately reflects meaningful exploitation barriers: the local attack vector (AV:L) eliminates remote exploitation, the high attack complexity (AC:H) requires specific conditions to be met beyond mere access, and the low-privilege prerequisite (PR:L) demands an established local account on the target infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's August 2026 Critical Security Patch Update, which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.